/csphash — CSP Hash Generator
Paste the exact body of an inline
<script> or <style> and get the 'sha256-…' / 'sha384-…' / 'sha512-…' source token a browser will demand before it runs or applies that inline content — no more 'unsafe-inline'. Everything is hashed with crypto.subtle in your browser; nothing is uploaded.
Gotchas, learned from hardening this site's own CSP:
- The hash covers exact bytes — everything between the tags (or the whole external file), not including the
<script>/<style>tags themselves. Add one trailing space, re-indent, or let a formatter touch it, and the hash — and the browser's match — silently breaks. Paste content exactly as it will be served, byte for byte. - Inline event-handler attributes (
onclick="…",onload="…", …) need the extra'unsafe-hashes'source expression alongside the hash token — a plain hash only covers<script>/<style>element bodies. Tick the checkbox below for those, and check browser support before relying on it. - Hash vs. nonce: a nonce (
'nonce-…') is a fresh random value stamped into the header and the tag on every response — great for server-rendered pages, but it means the response can't be cached as static output and the server must generate a new one each request. A hash is static: no per-request work, cacheable, but it must be recomputed (and the CSP redeployed) every time the snippet's bytes change — better suited to fixed, rarely-changing inline code than templated content. - Only SHA-256, SHA-384 and SHA-512 are valid CSP hash algorithms — SHA-1 and MD5 are not accepted, however strong the actual hash is.
- Once a directive has any
'nonce-…'or hash source, spec-compliant browsers ignore a co-present'unsafe-inline'— that's the standard fallback pattern for old browsers, it isn't a bypass. - Prefer moving the code to an external file over
script-src 'self'when you can — no hash bookkeeping at all. Hashes are for the inline snippets you're stuck with.
Ready to paste